From multi-values event to splitted single-value events?

[PeterGian]

Hello community!
For a project I'm working on, I would need to split a "multivalues single event" into "multiple single value events".

Let me try to represent it for clarity:

As is:

Event:
A B C null D
    E F    G
    H I    L

Desired:

Event1:
A B C null D 
Event2:
A B E F G
Event3:
A B H I L

 Is it possible to achieve this? 

I played around with mvexpand and mvzip but I wasn't able to reach my goal.

Thanks in advance for your kind support

[PeterGian]

Works like a charm! Thanks

[ITWhisperer]

Please can you clarify the events you are actually dealing with, as the representation you have used is unclear.

For example, are there actually 5 fields in your event, the last 3 being multi-value fields, or are the last 3 actually 3 occurrences of 3 fields such that the first occurrence has no value for the second field of the 3, or does it actually contain the word "null"?

There are possibly other interpretations of your representation too.

[PeterGian]

Hello,

thanks for your interest.

In the event there are 5 fields and the last 3 are multi-value fields. You are right, the word "null" could be misleading in this context, it is just representing the word "null" so it could be changed with whatever value.

[ITWhisperer]

| makeresults
| fields - _time
| eval field1="A"
| eval field2="B"
| eval field3=split("CEH","")
| eval field4=split("null,F,I",",")
| eval field5=split("DGL","")
``` The lines above just set up data inline with your example ```
| eval combined=mvzip(field3,mvzip(field4,field5,"|"),"|")
| mvexpand combined
| eval field3=mvindex(split(combined,"|"),0)
| eval field4=mvindex(split(combined,"|"),1)
| eval field5=mvindex(split(combined,"|"),2)
| fields - combined